Topic
Exact versions, recorded checksums and commit references as a bound on which code an install is allowed to fetch.
GitHub's Actions lockfile, in public preview since October 2026, pins each action in a workflow to a commit SHA, DEV Community reports. A pinned commit that vanishes fails the run, so teams trade silent drift for hard errors.
Reality
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Reality
SHA pinning drew a clean line through the tj-actions compromise, and then Dependabot began bumping hashes faster than anyone could read them. The claim worth enforcing is the version comment that nothing verifies.
Reality
Oracle's October 20 patch makes JDK 21.0.13 the first JDK 21 build that needs a paid subscription for production use. Any image that tracks the latest Oracle build installs it on its next patch run, and the bill is counted per employee.
Reality
In AIR's Plugin4Shell research, a branch named after the hash you pinned wins the checkout in Claude Code, Codex, Copilot and Gemini CLI. The check that would catch it is one line of git, run on your disk.
Reality
The Python SDK's v2.0.0 moved mcp.server.fastmcp wholesale on July 28 and shipped no shim, so any project that wrote mcp>=1.0 pulls 2.x on the next fresh install. A second default quietly changed the name clients see.
Reality
Pinning a workflow to a commit SHA stops the tag moving under you, and resolving all 31 from the upstream repositories turned up an action whose v3 tag stopped moving at all while its releases reached v5.0.0.
Reality
The MCP Python SDK renamed FastMCP in 2.x. Gemini's Interactions API stopped accepting the schema google-genai 1.x sends. Both arrived on a fresh install of unchanged code, and the mocked unit tests never noticed.
Reality
An AWS EC2 rig with mcp unbounded in requirements.txt picked up mcp 2.2.0 and stopped importing. The server edit is two lines; the pip resolver and the test suite's camelCase attribute reads are where the work sits.
Reality
The project reports 2,931,581,192 matching checks over the full ChEMBL 37 structure table with zero blocking mismatch against a pinned RDKit 2026.03.1, and the pin is the line that sets your upgrade bill.
Reality